corspost请求失败_javascript – Tomcat CORS：预检成功,但实际请求失败,403禁止

我的REST服务部署在Tomcat 7.0.64(http://localhost:8080/xxx)下.我使用HTML页面源代码的JavaScript库来调用这些服务.这些HTML页面由另一个orgin(http://localhost:9090/html/yyy.html)提供.

要在服务器上启用跨源请求,我在web.xml中配置了CORSFilter,如下所示：

CorsFilter

org.apache.catalina.filters.CorsFilter

cors.allowed.origins

*

cors.allowed.methods

GET,POST,HEAD,OPTIONS,PUT,PATCH,DELETE

cors.allowed.headers

Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,X-CUSTOM1,X-CUSOM2,X-CUSTOM3

cors.exposed.headers

Access-Control-Allow-Origin,Access-Control-Allow-Credentials,X-CUSTOM3

cors.support.credentials

true

cors.preflight.maxage

10

CorsFilter

*

从RequestDumper的以下输出中,您可以注意到来自浏览器的预检请求已收到成功响应(200).但是,403 Forbidden后面的实际请求失败了：

预检请求和响应

http-apr-8080-exec-6 ===============================================================

http-apr-8080-exec-8 START TIME =26-Sep-2015 21:28:53

http-apr-8080-exec-8 requestURI=/xxxx/zzzz

http-apr-8080-exec-8 authType=null

http-apr-8080-exec-8 characterEncoding=null

http-apr-8080-exec-8 contentLength=-1

http-apr-8080-exec-8 contentType=null

http-apr-8080-exec-8 contextPath=/xxxx

http-apr-8080-exec-8 header=host=localhost:8080

http-apr-8080-exec-8 header=connection=keep-alive

http-apr-8080-exec-8 header=pragma=no-cache

http-apr-8080-exec-8 header=cache-control=no-cache

http-apr-8080-exec-8 header=access-control-request-method=POST

http-apr-8080-exec-8 header=origin=http://localhost:9090

http-apr-8080-exec-8 header=user-agent=Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.42 Safari/537.36

http-apr-8080-exec-8 header=access-control-request-headers=x-custom1, x-custom2

http-apr-8080-exec-8 header=accept=*/*

http-apr-8080-exec-8 header=referer=http://localhost:9090/html/yyyy.html

http-apr-8080-exec-8 header=accept-encoding=gzip, deflate, sdch

http-apr-8080-exec-8 header=accept-language=en-US,en;q=0.8,ta;q=0.6

http-apr-8080-exec-8 locale=en_US

http-apr-8080-exec-8 method=OPTIONS

http-apr-8080-exec-8 pathInfo=null

http-apr-8080-exec-8 protocol=HTTP/1.1

http-apr-8080-exec-8 queryString=null

http-apr-8080-exec-8 remoteAddr=127.0.0.1

http-apr-8080-exec-8 remoteHost=127.0.0.1

http-apr-8080-exec-8 remoteUser=null

http-apr-8080-exec-8 requestedSessionId=null

http-apr-8080-exec-8 scheme=http

http-apr-8080-exec-8 serverName=localhost

http-apr-8080-exec-8 serverPort=8080

http-apr-8080-exec-8 servletPath=/zzzz

http-apr-8080-exec-8 isSecure=false

http-apr-8080-exec-8 ------------------=--------------------------------------------

http-apr-8080-exec-8 ------------------=--------------------------------------------

http-apr-8080-exec-8 authType=null

http-apr-8080-exec-8 contentType=null

http-apr-8080-exec-8 header=Access-Control-Allow-Origin=http://localhost:9090

http-apr-8080-exec-8 header=Access-Control-Allow-Credentials=true

http-apr-8080-exec-8 header=Access-Control-Max-Age=10

http-apr-8080-exec-8 header=Access-Control-Allow-Methods=POST

http-apr-8080-exec-8 header=Access-Control-Allow-Headers=content-type,x-custom1,access-control-request-headers,accept,access-control-request-method,x-custom2,origin,x-custom3,x-requested-with

http-apr-8080-exec-8 remoteUser=null

http-apr-8080-exec-8 status=200

http-apr-8080-exec-8 END TIME =26-Sep-2015 21:28:53

http-apr-8080-exec-8 ===============================================================

实际请求和响应 – 403 Forbidden失败

http-apr-8080-exec-9 START TIME =26-Sep-2015 21:28:53

http-apr-8080-exec-9 requestURI=/xxxx/zzzz

http-apr-8080-exec-9 authType=null

http-apr-8080-exec-9 characterEncoding=null

http-apr-8080-exec-9 contentLength=0

http-apr-8080-exec-9 contentType=null

http-apr-8080-exec-9 contextPath=/xxxx

http-apr-8080-exec-9 header=host=localhost:8080

http-apr-8080-exec-9 header=connection=keep-alive

http-apr-8080-exec-9 header=content-length=0

http-apr-8080-exec-9 header=pragma=no-cache

http-apr-8080-exec-9 header=cache-control=no-cache

http-apr-8080-exec-9 header=origin=http://localhost:9090

http-apr-8080-exec-9 header=x-custom1=aaaaa

http-apr-8080-exec-9 header=x-custom2=bbbbb

http-apr-8080-exec-9 header=user-agent=Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.42 Safari/537.36

http-apr-8080-exec-9 header=accept=*/*

http-apr-8080-exec-9 header=referer=http://localhost:9090/html/yyyy.html

http-apr-8080-exec-9 header=accept-encoding=gzip, deflate

http-apr-8080-exec-9 header=accept-language=en-US,en;q=0.8,ta;q=0.6

http-apr-8080-exec-9 locale=en_US

http-apr-8080-exec-9 method=POST

http-apr-8080-exec-9 pathInfo=null

http-apr-8080-exec-9 protocol=HTTP/1.1

http-apr-8080-exec-9 queryString=null

http-apr-8080-exec-9 remoteAddr=127.0.0.1

http-apr-8080-exec-9 remoteHost=127.0.0.1

http-apr-8080-exec-9 remoteUser=null

http-apr-8080-exec-9 requestedSessionId=null

http-apr-8080-exec-9 scheme=http

http-apr-8080-exec-9 serverName=localhost

http-apr-8080-exec-9 serverPort=8080

http-apr-8080-exec-9 servletPath=/zzzz

http-apr-8080-exec-9 isSecure=false

http-apr-8080-exec-9 ------------------=--------------------------------------------

http-apr-8080-exec-9 ------------------=--------------------------------------------

http-apr-8080-exec-9 authType=null

http-apr-8080-exec-9 contentType=text/plain

http-apr-8080-exec-9 remoteUser=null

http-apr-8080-exec-9 status=403

http-apr-8080-exec-9 END TIME =26-Sep-2015 21:28:53

http-apr-8080-exec-9 ===============================================================

我使用Chrome作为浏览器.

我想知道,当预检请求成功时,实际响应是否可能被禁止403？

Also please note that I have tested sending this same request from

Chrome plugin Postman and I could get the expected response

successfully without 403 error.

我经历了以下流程：Tomcat CORSFilter flowchart.我不清楚这里出了什么问题.感谢您在解决问题方面的帮助.谢谢.

解决方法:

我遇到了完全相同的问题.解决方案实际上非常简单.

尝试在POST请求中添加Content-Type.来源：https://www.icode9.com/content-1-361901.html